Privacy Policy
Last updated: February 27, 2025
This policy explains what personal data we collect, how we use it, and your rights — compliant with KVKK (Turkey) and GDPR (EU/EEA).
1. Data Controller
AxonProm ("we", "us", or "our") is the data controller responsible for your personal data. We are established in the Republic of Turkey and operate the project management platform available at axonprom.com. For KVKK (Law No. 6698 on Protection of Personal Data) and GDPR purposes, AxonProm acts as the data controller. Contact: privacy@axonprom.com
2. Data We Collect
We collect the following categories of personal data: • Identity Data: name, username, job title • Contact Data: email address • Account Data: password (hashed), role, permissions, team membership • Usage Data: log data, IP address, browser type, pages visited, features used, session duration • Content Data: work items, notes, time entries, reports, and file attachments you create or upload • Payment Data: billing information processed by our payment provider (Paddle). We do not store raw card data. • Technical Data: cookies, local storage tokens, device identifiers
3. How We Use Your Data
We use your data for the following purposes: • Providing and operating the Service • Account authentication and security (login rate limiting, session management) • Sending transactional emails (verification, password reset, billing notifications) • Enforcing subscription plan limits and billing • Improving the Service through aggregated analytics • Complying with legal obligations under Turkish law (KVKK), EU GDPR, and other applicable regulations We do not sell, rent, or share your personal data with third parties for marketing purposes.
4. Legal Basis for Processing
We process your personal data on the following legal bases: • Contract performance: processing necessary to provide the Service you have signed up for • Legitimate interests: security monitoring, fraud prevention, service improvement • Consent: marketing communications (where applicable, with opt-in) • Legal obligation: compliance with tax, accounting, and regulatory requirements For users in the EU/EEA, our processing is governed by GDPR Article 6. For users in Turkey, our processing is governed by KVKK Article 5.
5. Data Retention
We retain your personal data for as long as your account is active or as needed to provide the Service. After account termination: • Account data is deleted within 90 days • Billing and transaction records are retained for 10 years as required by Turkish commercial law • Logs are retained for 12 months for security purposes You may request earlier deletion subject to legal retention requirements.
6. Third-Party Services
We share data with the following categories of third-party service providers who process data on our behalf: • Cloud hosting providers (data storage and compute) • Paddle (payment processing) — Paddle acts as the Merchant of Record and has its own privacy policy • Email delivery providers (transactional email) • Error monitoring and analytics tools All third-party processors are contractually bound to protect your data and may not use it for their own purposes.
7. International Data Transfers
Your data may be transferred to and processed in countries outside Turkey and the EEA. When this occurs, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) or other legally approved transfer mechanisms, as required by GDPR and KVKK.
8. Cookies & Tracking
We use essential cookies required for authentication (session cookie, HttpOnly, Secure). We do not use advertising or tracking cookies. You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging into the Service.
9. Your Rights
Depending on your location, you may have the following rights: • Access: request a copy of your personal data • Rectification: correct inaccurate data • Erasure: request deletion of your data ("right to be forgotten") • Portability: receive your data in a structured, machine-readable format • Restriction: restrict processing of your data • Objection: object to processing based on legitimate interests • Withdrawal of consent: where processing is based on consent Turkish users may also exercise rights under KVKK Article 11. To exercise any right, email: privacy@axonprom.com. We will respond within 30 days.
10. Data Security
We implement industry-standard security measures including: • Password hashing (bcrypt) • HTTPS/TLS encryption for all data in transit • HttpOnly, Secure session cookies • Login rate limiting and account lockout after failed attempts • Role-based access control (RBAC) • Regular security reviews No method of transmission or storage is 100% secure. We will notify you of any data breach affecting your personal data as required by applicable law.
11. Children's Privacy
The Service is not directed to children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately at privacy@axonprom.com and we will delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice within the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
13. Contact & Complaints
For any privacy-related questions or to exercise your rights, contact us at: privacy@axonprom.com If you are in the EU/EEA and believe we have not addressed your concern adequately, you have the right to lodge a complaint with your local data protection authority. Turkish users may also apply to the Personal Data Protection Authority (KVKK Kurumu) at kvkk.gov.tr.